Extracting prog: 12m35.667184568s Minimizing prog: 7m54.223519963s Simplifying prog options: 0s Extracting C: 21.809249299s Simplifying C: 11m12.975703894s extracting reproducer from 32 programs testing a last program of every proc single: executing 7 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_DEVICE detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xf000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(r1, 0xc018aec0, &(0x7f00000000c0)={0x1}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-setsockopt$sock_int-sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED-sendmsg$IPCTNL_MSG_CT_GET-close detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000040)=0x3, 0x4) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x7, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x80) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000480)=ANY=[@ANYBLOB="1400000001010101"], 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x90) close(r0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-setsockopt$inet6_udp_int-connect$inet6-connect$inet6-write detailed listing: executing program 0: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000180)=0x4, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x8}, 0x1c) connect$inet6(r0, &(0x7f0000000740)={0xa, 0x4e25, 0x4, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x20000000}, 0x1c) write(r0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ptrace-sched_setattr-sched_setattr-sched_setattr detailed listing: executing program 0: ptrace(0x10, 0x1) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x6, 0x0, 0x0, 0x0, 0x8000000009917, 0x400000000000fffd}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x0, 0x0, 0xffffffffffffffff}, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x0, 0x1}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ptrace-sched_setattr-sched_setattr-sched_setattr detailed listing: executing program 0: ptrace(0x10, 0x1) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x6, 0x0, 0x0, 0x0, 0x8000000009917, 0x400000000000fffd}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x0, 0x0, 0xffffffffffffffff}, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x0, 0x1}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write$binfmt_elf64-close-execveat detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r0, &(0x7f0000000880)={{0x7f, 0x45, 0x4c, 0x46, 0x20, 0x4, 0x0, 0x0, 0x0, 0x2, 0x3e, 0x9, 0x7c, 0x40, 0x2, 0x7f, 0x6, 0x38, 0x1, 0xfffe, 0x3, 0x3}, [{0x3, 0x3, 0xfeca, 0x11, 0x0, 0xe5, 0xfffffffffffffffe, 0x3}]}, 0x9e) close(r0) execveat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0, 0x1000) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-write$binfmt_elf64-close-execveat detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r0, &(0x7f0000000880)={{0x7f, 0x45, 0x4c, 0x46, 0x20, 0x4, 0x0, 0x0, 0x0, 0x2, 0x3e, 0x9, 0x7c, 0x40, 0x2, 0x7f, 0x6, 0x38, 0x1, 0xfffe, 0x3, 0x3}, [{0x3, 0x3, 0xfeca, 0x11, 0x0, 0xe5, 0xfffffffffffffffe, 0x3}]}, 0x9e) close(r0) execveat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0, 0x1000) program did not crash single: failed to extract reproducer bisect: bisecting 32 programs with base timeout 30s testing program (duration=38s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2803, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x34, 0x0, 0x9}]}) executing program 0: pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r0, 0x407, 0x700007c) capset(&(0x7f0000002400)={0x19980330}, &(0x7f0000002440)={0x0, 0x0, 0x3, 0xfffffc01, 0x398, 0x8a}) pipe2(&(0x7f0000000040), 0x0) executing program 0: unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip6_tables_matches\x00') lseek(r0, 0x6, 0x1) executing program 0: syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r0, &(0x7f0000000040)={0x24, @short={0x2, 0x3, 0xaaa3}}, 0x14) executing program 0: brk(0x5d555ede6000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./sys/kernel/tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r0, &(0x7f0000000880)={{0x7f, 0x45, 0x4c, 0x46, 0x20, 0x4, 0x0, 0x0, 0x0, 0x2, 0x3e, 0x9, 0x7c, 0x40, 0x2, 0x7f, 0x6, 0x38, 0x1, 0xfffe, 0x3, 0x3}, [{0x3, 0x3, 0xfeca, 0x11, 0x0, 0xe5, 0xfffffffffffffffe, 0x3}]}, 0x9e) close(r0) execveat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0, 0x1000) executing program 32: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r0, &(0x7f0000000880)={{0x7f, 0x45, 0x4c, 0x46, 0x20, 0x4, 0x0, 0x0, 0x0, 0x2, 0x3e, 0x9, 0x7c, 0x40, 0x2, 0x7f, 0x6, 0x38, 0x1, 0xfffe, 0x3, 0x3}, [{0x3, 0x3, 0xfeca, 0x11, 0x0, 0xe5, 0xfffffffffffffffe, 0x3}]}, 0x9e) close(r0) execveat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0, 0x1000) executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/ttyS0\x00', 0x2, 0x0) ioctl(r0, 0x400455c8, 0x0) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000140)={0x0, {0x2, 0x3, @multicast1}, {0x2, 0x0, @local}, {0x2, 0x0, @multicast2}, 0xa4, 0x0, 0x0, 0x0, 0x5, 0x0, 0xe41}) r1 = socket$igmp(0x2, 0x3, 0x2) sendmsg$inet(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}, 0x0) executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) executing program 2: r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007c, 0x0) r2 = dup3(r0, r1, 0x0) ioctl$MON_IOCG_STATS(r2, 0x80089203, 0x0) executing program 2: ptrace(0x10, 0x1) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x6, 0x0, 0x0, 0x0, 0x8000000009917, 0x400000000000fffd}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x0, 0x0, 0xffffffffffffffff}, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x0, 0x1}, 0x0) executing program 33: ptrace(0x10, 0x1) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x6, 0x0, 0x0, 0x0, 0x8000000009917, 0x400000000000fffd}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x0, 0x0, 0xffffffffffffffff}, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x0, 0x1}, 0x0) executing program 4: mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x28e7840, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='\x00', 0x274) executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000400)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) sendmmsg$inet(r1, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4008000) executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x6684916) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a000002", 0x16}], 0x1, 0x0, 0x0) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) setsockopt$inet6_buf(r0, 0x29, 0x3e, &(0x7f00002cef88)="d84f7398", 0x4) sendto$inet6(r0, &(0x7f0000001380)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e612721c20051608d9aa6dacf61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ec3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a068e9607f57f626a5b8d476636ef1ee76307524009ae49be402000000000000001e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b263630c7d6fc35dda6002da571a2e51917e7c1019d8ce21a608147e408074c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dfff01a9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669cabc206c944317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb252f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2e02fad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea093680ffffff802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c59d88a29af5886c1f5dfc6837c58aaef12a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f53baf7ec5bb6cc96b917dde82c18840c3500e9565f68f687b1c73d834c0d99d4acb002dc5682dbcdb1217a98f6c3ef8318b7fa93894e8a097b4511ba5c035e27c9fe8bfe7754741ac21bbc0303b81672e3117e5590fe2d92f912759b9937f64204ec5caa92e2cccb31016b13ed8d7bcabb03e176b1c9bda3bf1c1256ab74ab6f42ed9bafbbd0096263be1a7da1e1c88deec55a653d170e1e13c77dacaa60a37a6ba2383e661ebc9f13dbaade2dd884c9951819fb4608e19e70cd2496ccfb12f24c710400cfe90400fe1bbea1e9a24b1d4664fb0776aca6269b396779680e52f86877d9209988d12ccb137be01ab7496d00547a7d4849d365a18dbb55c429cde87d33c4b74ad2273cdfee88b5418866ef327f25e9cbcd5a64d97107339f7e4cb5f8de171d2779c0f68884ae835e398f982d5749f085628d3608986656ea04b721f828202e9342bd7d19dfa091e772aebf9718030167a8c029df7c58b7f40029d7cfcaf26fd1900d8775ef373e8e2c5bf3525f907add3be426cd5a079c49abffe933e9ee213a3baf34f932d1299312691e1c53e6247ae0989ad66070d51fad22856a8b6b28954e7d41189b11c5321789eec8670de9e8db0b0473ba2e02731e60e7222697d61e052c18d4bcc6d1572fdf426f7b2fee6c1dee66c85c497b90facaf63b8ec5cde4a73400f9180bcfc0f81eca9580a7c81462a077f9034026bf72aa7c6de4b3c15d4a2dbd6fd7d87084aea9f25fb4bf5ec83eb56874a760533792dff2695407ccdd6a7375e0007230fd3f6501c152f1c1ff279b1d67cc95f2820762b7927659368e41657bdef2dd15b63498a93b787bdb26809d734aaf98b86fcf9fc643a34d03ebbe09000000000000004d66c5ae270adade5b8f6242a059b926221ee3d677487471c432b0d6d64dad030703475bb3ecac39b204a814f5ece5961621358e36f8a2", 0x575, 0x0, &(0x7f0000000080)={0xa, 0x5e28, 0x9, @mcast2, 0x7}, 0x1c) readv(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/140, 0x8c}], 0x1) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./proc/fs/nfsd\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x78) lseek(r0, 0x7fffdfff, 0x2) executing program 3: ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wg0\x00'}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'syztnl2\x00', 0x0}) socket$inet(0x2, 0x6, 0x8) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x2, 0x2, 0x401, 0x0, 0x0, {0x5, 0x0, 0x8}, [@CTA_EXPECT_HELP_NAME={0xe, 0x6, 'irc-20000\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x2000c884}, 0x44800) executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000380), 0x1000a) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) executing program 1: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000002180), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x140000000) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0xeb95d000) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r1, &(0x7f0000000080), 0x8) executing program 3: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/nf_conntrack/parameters/hashsize\x00', 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0x30, 0x5, 0x0, {0x0, 0x2, 0x3ff, 0x6}}, 0x30) executing program 4: socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='!\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r0}]}, 0x24}}, 0x0) executing program 1: getpgid(0x0) prctl$PR_GET_CHILD_SUBREAPER(0x25) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r0, 0x4018aee2, &(0x7f0000000200)) executing program 3: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f0000005cc0)='./file0\x00') executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000040)={0x18, 0x2, {0x1, @empty}}, 0x1e) connect$pptp(r0, &(0x7f0000002280)={0x18, 0x2, {0xfffa, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) executing program 1: r0 = socket$packet(0x11, 0xa, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff02000000000000000000000000000183"], 0xfdef) executing program 3: r0 = userfaultfd(0x801) munmap(&(0x7f00005aa000/0x3000)=nil, 0x3000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000040)={{&(0x7f00005aa000/0x2000)=nil, 0x2000}}) executing program 4: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000180)=0x4, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x8}, 0x1c) connect$inet6(r0, &(0x7f0000000740)={0xa, 0x4e25, 0x4, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x20000000}, 0x1c) write(r0, 0x0, 0x0) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000040)=0x3, 0x4) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x7, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x80) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000480)=ANY=[@ANYBLOB="1400000001010101"], 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x90) close(r0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xf000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(r1, 0xc018aec0, &(0x7f00000000c0)={0x1}) program crashed: WARNING in shmem_rmdir bisect: bisecting 32 programs bisect: split chunks (needed=false): <32> bisect: split chunk #0 of len 32 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 2: r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007c, 0x0) r2 = dup3(r0, r1, 0x0) ioctl$MON_IOCG_STATS(r2, 0x80089203, 0x0) executing program 2: ptrace(0x10, 0x1) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x6, 0x0, 0x0, 0x0, 0x8000000009917, 0x400000000000fffd}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x0, 0x0, 0xffffffffffffffff}, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x0, 0x1}, 0x0) executing program 33: ptrace(0x10, 0x1) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x6, 0x0, 0x0, 0x0, 0x8000000009917, 0x400000000000fffd}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x0, 0x0, 0xffffffffffffffff}, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x0, 0x1}, 0x0) executing program 4: mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x28e7840, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='\x00', 0x274) executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000400)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) sendmmsg$inet(r1, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4008000) executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x6684916) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a000002", 0x16}], 0x1, 0x0, 0x0) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) setsockopt$inet6_buf(r0, 0x29, 0x3e, &(0x7f00002cef88)="d84f7398", 0x4) sendto$inet6(r0, &(0x7f0000001380)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e612721c20051608d9aa6dacf61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ec3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a068e9607f57f626a5b8d476636ef1ee76307524009ae49be402000000000000001e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b263630c7d6fc35dda6002da571a2e51917e7c1019d8ce21a608147e408074c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dfff01a9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669cabc206c944317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb252f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2e02fad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea093680ffffff802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c59d88a29af5886c1f5dfc6837c58aaef12a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f53baf7ec5bb6cc96b917dde82c18840c3500e9565f68f687b1c73d834c0d99d4acb002dc5682dbcdb1217a98f6c3ef8318b7fa93894e8a097b4511ba5c035e27c9fe8bfe7754741ac21bbc0303b81672e3117e5590fe2d92f912759b9937f64204ec5caa92e2cccb31016b13ed8d7bcabb03e176b1c9bda3bf1c1256ab74ab6f42ed9bafbbd0096263be1a7da1e1c88deec55a653d170e1e13c77dacaa60a37a6ba2383e661ebc9f13dbaade2dd884c9951819fb4608e19e70cd2496ccfb12f24c710400cfe90400fe1bbea1e9a24b1d4664fb0776aca6269b396779680e52f86877d9209988d12ccb137be01ab7496d00547a7d4849d365a18dbb55c429cde87d33c4b74ad2273cdfee88b5418866ef327f25e9cbcd5a64d97107339f7e4cb5f8de171d2779c0f68884ae835e398f982d5749f085628d3608986656ea04b721f828202e9342bd7d19dfa091e772aebf9718030167a8c029df7c58b7f40029d7cfcaf26fd1900d8775ef373e8e2c5bf3525f907add3be426cd5a079c49abffe933e9ee213a3baf34f932d1299312691e1c53e6247ae0989ad66070d51fad22856a8b6b28954e7d41189b11c5321789eec8670de9e8db0b0473ba2e02731e60e7222697d61e052c18d4bcc6d1572fdf426f7b2fee6c1dee66c85c497b90facaf63b8ec5cde4a73400f9180bcfc0f81eca9580a7c81462a077f9034026bf72aa7c6de4b3c15d4a2dbd6fd7d87084aea9f25fb4bf5ec83eb56874a760533792dff2695407ccdd6a7375e0007230fd3f6501c152f1c1ff279b1d67cc95f2820762b7927659368e41657bdef2dd15b63498a93b787bdb26809d734aaf98b86fcf9fc643a34d03ebbe09000000000000004d66c5ae270adade5b8f6242a059b926221ee3d677487471c432b0d6d64dad030703475bb3ecac39b204a814f5ece5961621358e36f8a2", 0x575, 0x0, &(0x7f0000000080)={0xa, 0x5e28, 0x9, @mcast2, 0x7}, 0x1c) readv(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/140, 0x8c}], 0x1) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./proc/fs/nfsd\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x78) lseek(r0, 0x7fffdfff, 0x2) executing program 3: ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wg0\x00'}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'syztnl2\x00', 0x0}) socket$inet(0x2, 0x6, 0x8) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x2, 0x2, 0x401, 0x0, 0x0, {0x5, 0x0, 0x8}, [@CTA_EXPECT_HELP_NAME={0xe, 0x6, 'irc-20000\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x2000c884}, 0x44800) executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000380), 0x1000a) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) executing program 1: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000002180), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x140000000) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0xeb95d000) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r1, &(0x7f0000000080), 0x8) executing program 3: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/nf_conntrack/parameters/hashsize\x00', 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0x30, 0x5, 0x0, {0x0, 0x2, 0x3ff, 0x6}}, 0x30) executing program 4: socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='!\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r0}]}, 0x24}}, 0x0) executing program 1: getpgid(0x0) prctl$PR_GET_CHILD_SUBREAPER(0x25) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r0, 0x4018aee2, &(0x7f0000000200)) executing program 3: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f0000005cc0)='./file0\x00') executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000040)={0x18, 0x2, {0x1, @empty}}, 0x1e) connect$pptp(r0, &(0x7f0000002280)={0x18, 0x2, {0xfffa, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) executing program 1: r0 = socket$packet(0x11, 0xa, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff02000000000000000000000000000183"], 0xfdef) executing program 3: r0 = userfaultfd(0x801) munmap(&(0x7f00005aa000/0x3000)=nil, 0x3000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000040)={{&(0x7f00005aa000/0x2000)=nil, 0x2000}}) executing program 4: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000180)=0x4, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x8}, 0x1c) connect$inet6(r0, &(0x7f0000000740)={0xa, 0x4e25, 0x4, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x20000000}, 0x1c) write(r0, 0x0, 0x0) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000040)=0x3, 0x4) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x7, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x80) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000480)=ANY=[@ANYBLOB="1400000001010101"], 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x90) close(r0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xf000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(r1, 0xc018aec0, &(0x7f00000000c0)={0x1}) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 3: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/nf_conntrack/parameters/hashsize\x00', 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0x30, 0x5, 0x0, {0x0, 0x2, 0x3ff, 0x6}}, 0x30) executing program 4: socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='!\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r0}]}, 0x24}}, 0x0) executing program 1: getpgid(0x0) prctl$PR_GET_CHILD_SUBREAPER(0x25) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r0, 0x4018aee2, &(0x7f0000000200)) executing program 3: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f0000005cc0)='./file0\x00') executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000040)={0x18, 0x2, {0x1, @empty}}, 0x1e) connect$pptp(r0, &(0x7f0000002280)={0x18, 0x2, {0xfffa, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) executing program 1: r0 = socket$packet(0x11, 0xa, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff02000000000000000000000000000183"], 0xfdef) executing program 3: r0 = userfaultfd(0x801) munmap(&(0x7f00005aa000/0x3000)=nil, 0x3000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000040)={{&(0x7f00005aa000/0x2000)=nil, 0x2000}}) executing program 4: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000180)=0x4, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x8}, 0x1c) connect$inet6(r0, &(0x7f0000000740)={0xa, 0x4e25, 0x4, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x20000000}, 0x1c) write(r0, 0x0, 0x0) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000040)=0x3, 0x4) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x7, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x80) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000480)=ANY=[@ANYBLOB="1400000001010101"], 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x90) close(r0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xf000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(r1, 0xc018aec0, &(0x7f00000000c0)={0x1}) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <10> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5] detailed listing: executing program 1: r0 = socket$packet(0x11, 0xa, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff02000000000000000000000000000183"], 0xfdef) executing program 3: r0 = userfaultfd(0x801) munmap(&(0x7f00005aa000/0x3000)=nil, 0x3000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000040)={{&(0x7f00005aa000/0x2000)=nil, 0x2000}}) executing program 4: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000180)=0x4, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x8}, 0x1c) connect$inet6(r0, &(0x7f0000000740)={0xa, 0x4e25, 0x4, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x20000000}, 0x1c) write(r0, 0x0, 0x0) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000040)=0x3, 0x4) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x7, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x80) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000480)=ANY=[@ANYBLOB="1400000001010101"], 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x90) close(r0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xf000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(r1, 0xc018aec0, &(0x7f00000000c0)={0x1}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5] detailed listing: executing program 3: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/nf_conntrack/parameters/hashsize\x00', 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0x30, 0x5, 0x0, {0x0, 0x2, 0x3ff, 0x6}}, 0x30) executing program 4: socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='!\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r0}]}, 0x24}}, 0x0) executing program 1: getpgid(0x0) prctl$PR_GET_CHILD_SUBREAPER(0x25) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r0, 0x4018aee2, &(0x7f0000000200)) executing program 3: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f0000005cc0)='./file0\x00') executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000040)={0x18, 0x2, {0x1, @empty}}, 0x1e) connect$pptp(r0, &(0x7f0000002280)={0x18, 0x2, {0xfffa, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5] detailed listing: executing program 3: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f0000005cc0)='./file0\x00') executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000040)={0x18, 0x2, {0x1, @empty}}, 0x1e) connect$pptp(r0, &(0x7f0000002280)={0x18, 0x2, {0xfffa, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pptp-bind$pptp-socket$pptp-bind$pptp-connect$pptp detailed listing: executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000040)={0x18, 0x2, {0x1, @empty}}, 0x1e) connect$pptp(r0, &(0x7f0000002280)={0x18, 0x2, {0xfffa, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): creat-mkdir-mount$incfs-chdir-unlink detailed listing: executing program 3: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f0000005cc0)='./file0\x00') program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 3: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f0000005cc0)='./file0\x00') bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): creat-mkdir-mount$incfs-chdir-unlink detailed listing: executing program 0: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f0000005cc0)='./file0\x00') program crashed: WARNING in shmem_rmdir bisect: concatenation succeeded found reproducer with 5 syscalls minimizing guilty program testing program (duration=44.04695139s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): creat-mkdir-mount$incfs-chdir detailed listing: executing program 0: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') program crashed: WARNING in shmem_rmdir testing program (duration=44.04695139s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): creat-mkdir-mount$incfs detailed listing: executing program 0: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=44.04695139s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): creat-mkdir detailed listing: executing program 0: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) program did not crash testing program (duration=44.04695139s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): creat-mount$incfs detailed listing: executing program 0: creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=44.04695139s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=44.04695139s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(0x0, 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=44.04695139s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(0x0, &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=44.04695139s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=44.04695139s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', 0x0, 0xc002, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=44.04695139s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir simplifying C reproducer testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=44.04695139s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x13e) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true reproducing took 34m43.710405543s repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 1 PID: 376 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 1 UID: 0 PID: 376 Comm: syz-executor Not tainted syzkaller #0 1e1e3c2f05ad74614550ef0faab423d4afe8f9f4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 0f 0d ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 72 26 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc900011afc88 EFLAGS: 00010293 RAX: ffffffff81f253fe RBX: ffff8881172a21e8 RCX: ffff888115ea9300 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011afcb0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000235f80 R12: dffffc0000000000 R13: 1ffff11022e54446 R14: ffff8881172a2230 R15: 0000000000000000 FS: 0000555576236500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555576259958 CR3: 000000011353e000 CR4: 00000000003526b0 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3826 vfs_rmdir+0x3db/0x560 fs/namei.c:4348 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46f919f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc5fd5fa28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46f919f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc5fd5fae0 RBP: 00007ffc5fd5fae0 R08: 00007ffc5fd60ae0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc5fd60b70 R13: 00007f46f92344bb R14: 00000000000084a4 R15: 00007ffc5fd60bb0 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/376 CPU: 1 UID: 0 PID: 376 Comm: syz-executor Tainted: G W syzkaller #0 1e1e3c2f05ad74614550ef0faab423d4afe8f9f4 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:484 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46f919f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc5fd5fa28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46f919f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc5fd5fae0 RBP: 00007ffc5fd5fae0 R08: 00007ffc5fd60ae0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc5fd60b70 R13: 00007f46f92344bb R14: 00000000000084a4 R15: 00007ffc5fd60bb0 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 80000001175d1067 P4D 80000001175d1067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 376 Comm: syz-executor Tainted: G B W syzkaller #0 1e1e3c2f05ad74614550ef0faab423d4afe8f9f4 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 5d 1d 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 cc 03 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 6d RSP: 0018:ffffc900011afcc8 EFLAGS: 00010246 RAX: ffff888115ea9300 RBX: 0000000000000000 RCX: ffff888115ea9300 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011afcd8 R08: ffffffff88bbb947 R09: 1ffffffff1177728 R10: dffffc0000000000 R11: fffffbfff1177729 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 0000555576236500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 000000011353e000 CR4: 00000000003526b0 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46f919f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc5fd5fa28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46f919f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc5fd5fae0 RBP: 00007ffc5fd5fae0 R08: 00007ffc5fd60ae0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc5fd60b70 R13: 00007f46f92344bb R14: 00000000000084a4 R15: 00007ffc5fd60bb0 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 5d 1d 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 cc 03 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 6d RSP: 0018:ffffc900011afcc8 EFLAGS: 00010246 RAX: ffff888115ea9300 RBX: 0000000000000000 RCX: ffff888115ea9300 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011afcd8 R08: ffffffff88bbb947 R09: 1ffffffff1177728 R10: dffffc0000000000 R11: fffffbfff1177729 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 0000555576236500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 000000011353e000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 5d 1d 95 ff call 0xff951d70 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 cc 03 ee ff call 0xffee03f0 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 6d insl (%dx),%es:(%rdi) final repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 1 PID: 376 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 1 UID: 0 PID: 376 Comm: syz-executor Not tainted syzkaller #0 1e1e3c2f05ad74614550ef0faab423d4afe8f9f4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 0f 0d ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 72 26 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc900011afc88 EFLAGS: 00010293 RAX: ffffffff81f253fe RBX: ffff8881172a21e8 RCX: ffff888115ea9300 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011afcb0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000235f80 R12: dffffc0000000000 R13: 1ffff11022e54446 R14: ffff8881172a2230 R15: 0000000000000000 FS: 0000555576236500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555576259958 CR3: 000000011353e000 CR4: 00000000003526b0 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3826 vfs_rmdir+0x3db/0x560 fs/namei.c:4348 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46f919f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc5fd5fa28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46f919f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc5fd5fae0 RBP: 00007ffc5fd5fae0 R08: 00007ffc5fd60ae0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc5fd60b70 R13: 00007f46f92344bb R14: 00000000000084a4 R15: 00007ffc5fd60bb0 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/376 CPU: 1 UID: 0 PID: 376 Comm: syz-executor Tainted: G W syzkaller #0 1e1e3c2f05ad74614550ef0faab423d4afe8f9f4 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:484 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46f919f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc5fd5fa28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46f919f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc5fd5fae0 RBP: 00007ffc5fd5fae0 R08: 00007ffc5fd60ae0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc5fd60b70 R13: 00007f46f92344bb R14: 00000000000084a4 R15: 00007ffc5fd60bb0 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 80000001175d1067 P4D 80000001175d1067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 376 Comm: syz-executor Tainted: G B W syzkaller #0 1e1e3c2f05ad74614550ef0faab423d4afe8f9f4 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 5d 1d 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 cc 03 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 6d RSP: 0018:ffffc900011afcc8 EFLAGS: 00010246 RAX: ffff888115ea9300 RBX: 0000000000000000 RCX: ffff888115ea9300 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011afcd8 R08: ffffffff88bbb947 R09: 1ffffffff1177728 R10: dffffc0000000000 R11: fffffbfff1177729 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 0000555576236500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 000000011353e000 CR4: 00000000003526b0 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46f919f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc5fd5fa28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46f919f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc5fd5fae0 RBP: 00007ffc5fd5fae0 R08: 00007ffc5fd60ae0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc5fd60b70 R13: 00007f46f92344bb R14: 00000000000084a4 R15: 00007ffc5fd60bb0 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 5d 1d 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 cc 03 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 6d RSP: 0018:ffffc900011afcc8 EFLAGS: 00010246 RAX: ffff888115ea9300 RBX: 0000000000000000 RCX: ffff888115ea9300 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011afcd8 R08: ffffffff88bbb947 R09: 1ffffffff1177728 R10: dffffc0000000000 R11: fffffbfff1177729 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 0000555576236500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 000000011353e000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 5d 1d 95 ff call 0xff951d70 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 cc 03 ee ff call 0xffee03f0 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 6d insl (%dx),%es:(%rdi)